Sync AD from multiple on-premise server to Office 365

Question

I want to migrate active directory accounts from multiple on-premise servers (located on different location and having same domain name) to Office 365.

I am using Azure AD Connect to sync these accounts and I tested by creating a dummy environment (single server). Everything is working fine. Now the thing I want to know is that can I configure Azure AD Connect similarly on all my servers so that account from all servers will be synced on Office 365.

Points to note here:

1. I don't have any conflict in usernames on my server
2. I already have email account of users on office 365 and want to merge on-premise and Office 365 account based on username/ email address
3. I want password synchronization
4. Enable SSO (Single Sign On) for Office 365 account

My main doubt is about SSO because when I configured Azure AD Connect on my single server dummy environment, it configured SSO so if I will do same thing on all server do I need to do SSO configuration also or I have to leave this step one other servers?

Solution

I suggest you read this MS article:

https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-topologies

Specifically this section:

Single forest, multiple sync servers to one Azure AD tenant

Having multiple Azure AD Connect sync servers connected to the same Azure AD tenant is not supported, except for a staging server. It's unsupported even if these servers are configured to synchronize with a mutually exclusive set of objects. You might have considered this topology if you can't reach all domains in the forest from a single server, or if you want to distribute load across several servers.

You CAN have one or more STAGING servers, but they are only for DR purposes and really aren't even needed short of remembering your configuration/sync settings.

If you export and document your AADConnect settings/mappings/customization then you can just as easily rebuild a new AADConnect server in a DR scenario.

You CANNOT have more than one AADConnect sync server in your environment connecting to the same Azure AD tenant.

Comments

[Nikhil Gaur]

Hi TheCleaner, so you want to say even if all my server are on different locations (not connected to each other) and having separate set of usersnames but because they have same domain name so it will behave like single forest?

[kralyk]

@NikhilGaur - pretty much. You can't have one O365 tenant and multiple AADConnect servers syncing to that instance, even if it were multiple forests. You'd either need multiple O365 tenants federated together, or you'd need to setup a cross-forest trust and let one server on-premise sync everything for both forests up to a single tenant.